VibeSecurity — Security skill for Claude Code
Lightweight defensive security review skill for vibe-coded repositories.
How to install VibeSecurity
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open Master0fFate/VibeSecurity and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What VibeSecurity does
Lightweight defensive security review skill for vibe-coded repositories.
Alternatives in Security
- FastAPI Review — Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu 243.5k ★
- Security Best Practices — Review code for language-specific security vulnerabilities 14.6k ★
- Pal — Multi-model AI integration — chat, debugging, code review, planning, security audit 11.3k ★
README
VibeSecurity
Evidence-first security review for AI-assisted code. Every detector cites a CWE, an OWASP 2025 category, and an ASVS 5.0.0 requirement; every advisory carries a CVSS score, an EPSS probability, and its KEV status.
VibeSecurity is a defensive skill pack for reviewing repositories you own or are authorized to assess. It combines a compact threat-model workflow with a dependency-free Python helper that finds candidates, matches lockfiles against live advisory data, checks that your dependencies actually exist, and hands the agent standards-backed context for manual validation.
It is intentionally not a scanner platform, SaaS service, plugin runtime, or giant rule dump. Deterministic discovery narrows attention; the agent must still prove reachability, a crossed security boundary, realistic impact, and a verification path before reporting a vulnerability.
Why this exists, in numbers
| Measured fact | Source |
|---|---|
| LLMs chose the insecure implementation in 45% of curated tasks; Java over 70% | Veracode, 2025 GenAI Code Security Report |
| About 40% of Copilot-completed programs across CWE Top 25 scenarios contained the weakness | Pearce et al., IEEE S&P 2022 |
| 5.2% (commercial) to 21.7% (open-source) of generated package references do not exist; 205,474 unique hallucinated names | Spracklen et al., USENIX Security 2025 |
| 23.8 million new secrets on public GitHub in 2024, up 25%; 70% of 2022 leaks still valid | GitGuardian, State of Secrets Sprawl 2025 |
| 170 of 1,645 Lovable apps exposed Supabase tables to anyone holding the public key (CVE-2025-48757, CVSS 9.3) | NVD, May 2025 |
| 400+ exposed secrets and 2,000+ vulnerabilities across 5,600 vibe-coded apps | Escape.tech, October 2025 |
Sources, caveats, and the incident table (Tea, Moltbook) live in `.agents/skills/vibesecurity/references/evidence-base.md`. The `vibecoder` matcher pack targets exactly those failure modes: Supabase Row Level Security off, service keys in client bundl
Related Skills
Vibe Security Check Skill
Claude skill for automated security audit for vibe-coded apps. One command, 15 checks, auto-fix. Works with No
Information Security For Vibecoded Apps
An autonomous Application Security (AppSec) prompt and skill module for AI coding assistants (Antigravity, Cur
Avant Garde
Think before you build. Guard before you ship. A Claude skill: 6 foundation docs + a security gate before any
Helmops
AI-assisted (vibe-coded) browser-operating agent that enters invoices into an ERP with approvals, failure reco
Audit Design
Audit an existing codebase against its original docs/specs, auto-update stale docs, clean up dangling/duplicat
Maestro Odyssey
Long-running iterative cycle — one entry, seven modes (debug improve planex review security defensive ui). Sha
Related Agents
AI Code Security Auditor
Security reviewer for AI-generated and vibe-coded apps — hunts the hardcoded secrets, broken row-level securit
Security AI Generated Code Auditor
Security reviewer for AI-generated and vibe-coded apps — hunts the hardcoded secrets, broken row-level securit
Malware Analyst
You are an elite malware analyst focused on defensive security research. Your purpose is to help sec... opus w
